Re: [CDNi] Stephen Farrell's Discuss on draft-ietf-cdni-metadata-18: (with DISCUSS and COMMENT)

[Ben Niven-Jenkins <[e-mail]>]

> On 6 Jul 2016, at 21:15, Stephen Farrell <[e-mail]> wrote:
> On 06/07/16 19:48, Kevin Ma J wrote:
>>> - 1.2, last para: I don't get what this is saying. What additional
>>> things need specifying? If all you mean is that the dCDN and uCDN
>>> need to be able to setup TLS sessions, and hence need to agree on
>>> what CAs and ciphersuites to use, then maybe just say that. (You do
>>> already refer to RFC7525 so most of that is covered there I
>>> think.)
>> 
>> Yes, CAs and ciphersuites, but there was also the question of keys.
>> (I suppose if we went with the dCDNs generating their own keys it
>> would be doable?  Or if we left key sharing up to the CDNs to do
>> offline, similar to URI Signing?) At the time, way back when, some
>> folks looked at it and determined it to be too messy to tackle. More
>> recently, though I believe you've expressed some skepticism as to the
>> applicability of LURK to CDNI, 
> 
> Yeah - anything transitive with LURK is very scary. The "L" part
> becomes fairly meaningless I reckon. But that's a debate for another
> day.

In case it is useful...I was one of the folks Kevin mentions that was worried it was too messy to tackle for a couple of reasons (1) I was worried if we tried to specify some key distribution mechanism we’d come up against lots of resistance from security folks which would bog down progress, and (2) majority of the CDNI use cases I was aware of involved delivering video which was likely to be DRM’d (Nokia’s Velocix CDN product has supported HTTPS for years and I’m not aware of any of our customers delivering video over HTTPS primarily because their content is already DRM’d and they don’t want to pay the performance hit that comes with TLS for already encrypted content).

Ben